§3.20. Definitions. — Inbound Citations

(i) An entity seeking initial listing as a PSO must certify that it has written policies and procedures in place to perform each of the eight patient safety activities, defined in § 3.20. With respect to paragraphs (5) and (6) in the definition of patient safety activities regarding confidentiality and security, the policies and procedures must include and provide for:

(A) Compliance with the confidentiality provisions of subpart C of this part and with appropriate security measures as required by § 3.106 of this subpart.

(B) Notification of each provider that submitted patient safety work product or data as described in § 3.108(b)(2) to the entity if the submitted work product or data was subject to an unauthorized disclosure or its security was breached.

(A) Utilizes a patient safety evaluation system as defined in 42 CFR 3.20; and

(i) On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

(i) The medical records and billing records about individuals maintained by or for a covered health care provider;

(ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or